From: nada <nada@verdnatura.es>
To: pve-user@lists.proxmox.com
Subject: [PVE-User] migration from iptables to nftables
Date: Fri, 21 Jul 2023 11:49:33 +0200 [thread overview]
Message-ID: <3fec86b989521833db41524a04fc9a37@verdnatura.es> (raw)
hi folks
I am testing migration of firewall from iptables to nftables
my versions
* pve-manager/7.4-16/0f39f621 (running kernel: 5.15.108-1-pve)
* iptables 1.8.7-1
* nftables 0.9.8-3.1+deb11u1
# nft -V
nftables v0.9.8 (E.D.S.)
cli: editline
json: yes
minigmp: no
libxtables: yes
I've already translated rulesets from iptables to nftables
and want to deploy them at pve-firewall
PLS can anybody let me know the configuration of pve-firewall.service
for nft ?
current for iptables
# cat /lib/systemd/system/pve-firewall.service
[Unit]
Description=Proxmox VE firewall
ConditionPathExists=/usr/sbin/pve-firewall
Wants=pve-cluster.service pvefw-logger.service
After=pvefw-logger.service pve-cluster.service network.target
systemd-modules-load.service
DefaultDependencies=no
Before=shutdown.target
Conflicts=shutdown.target
[Service]
ExecStartPre=-/usr/bin/update-alternatives --set ebtables
/usr/sbin/ebtables-legacy
ExecStartPre=-/usr/bin/update-alternatives --set iptables
/usr/sbin/iptables-legacy
ExecStartPre=-/usr/bin/update-alternatives --set ip6tables
/usr/sbin/ip6tables-legacy
ExecStart=/usr/sbin/pve-firewall start
ExecStop=/usr/sbin/pve-firewall stop
ExecReload=/usr/sbin/pve-firewall restart
PIDFile=/run/pve-firewall.pid
Type=forking
[Install]
WantedBy=multi-user.target
thank you
NadaMac
reply other threads:[~2023-07-21 9:50 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3fec86b989521833db41524a04fc9a37@verdnatura.es \
--to=nada@verdnatura.es \
--cc=pve-user@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.